Memxus Remote Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Memxus Remote Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
Your memory travels with you.
Save context once. Recall it instantly across Claude, Cursor, ChatGPT, VS Code and any MCP-compatible client.
Website · Connect your first AI · Glama Inspector
</div>
<div align="center"> <video src="https://github.com/user-attachments/assets/99538f58-e404-4aff-8e9a-c6ea3213fbd3" width="100%" autoplay muted loop playsinline controls> <a href="https://www.memxus.com/demo">Watch the Memxus demo</a> </video> <br> <sub><a href="https://www.memxus.com/demo">Demo page</a> · <a href="https://www.memxus.com/memxus-demo.mp4">Direct MP4</a></sub> </div>
Every AI tool starts from zero.
Claude doesn't know what Cursor knows. Cursor doesn't know what ChatGPT knows. Your stack, project decisions, coding preferences and workflow context get repeated again and again.
Memxus fixes that with a shared long-term memory layer for your AI tools.
Save a decision in Claude → recall it in Cursor → reference it in ChatGPT → reuse it anywhere.
Memxus is a hosted remote MCP server that gives every AI client access to the same user-controlled long-term memory.
No local setup. No file syncing. No copy-pasting context between tools.
Connect once with OAuth and your context becomes portable across your entire AI workflow.
URL: https://mcp.memxus.com/mcp
Auth: OAuth 2.1 (handled automatically)
Transport: Streamable HTTPclaude_desktop_config.json){
"mcpServers": {
"memxus": {
"url": "https://mcp.memxus.com/mcp",
"transport": "streamable-http"
}
}
}{
"mcp": {
"servers": {
"memxus": {
"url": "https://mcp.memxus.com/mcp",
"transport": "http"
}
}
}
}Or open directly in Glama Inspector → https://glama.ai/mcp/inspector?url=https://mcp.memxus.com/mcp
For marketplace reviewers: see REVIEWER.md for OAuth and Bearer token setup.
| Platform | Integration | Status |
|---|---|---|
| Claude Desktop / claude.ai | Remote MCP | ✅ Live |
| Cursor | Remote MCP | ✅ Live |
| VS Code / Copilot MCP | Remote MCP | ✅ Live |
| ChatGPT | Custom GPT / API | ✅ Live |
| Gemini | MCP-compatible workflow | ✅ Live |
| Telegram | Bot connector | ✅ Live |
| Discord | Bot connector | 🔜 Coming soon |
| Slack | Bot connector | 🔜 Coming soon |
| Notion | Connector | 🔜 Coming soon |
| Any MCP-compatible client | Remote MCP | ✅ Live |
| Tool | Description |
|---|---|
remember | Save important information to long-term memory |
recall | Semantic search across your memories |
get_context | Build a formatted context block for a topic |
list_memories | Browse memories by collection, tags, or type |
get_memory | Retrieve a specific memory by ID |
forget | Delete a memory by ID |
list_collections | List all your memory collections |
memory_stats | Stats by type and collection |
MCP Client (Claude, Cursor, etc.)
│
│ POST /mcp Bearer aimem_*
▼
mcp.memxus.com ← This repo (Railway)
│
│ Supabase SDK
▼
Supabase (Postgres + pgvector)
│
▼
Dash-AIMemory (Dashboard)Transport: Streamable HTTP (MCP 2.0) Auth: OAuth 2.1 + PKCE + Dynamic Client Registration (RFC 9728)
1. Client → GET /.well-known/oauth-authorization-server
2. Client → GET /oauth/authorize → redirect to dashboard login
3. User signs in (Google) in the dashboard
4. Client → POST /oauth/token (PKCE) → aimem_* bearer token
5. Client → POST /mcp Authorization: Bearer aimem_*Dynamic Client Registration is supported — clients register automatically on first connect.
supabase/migration.sql after the dashboard migration)cp .env.example .env| Variable | Description |
|---|---|
MCP_PUBLIC_URL | Public URL of this server (no trailing slash) |
DASHBOARD_URL | Dash-AIMemory URL for login redirect |
SUPABASE_URL | Supabase project URL |
SUPABASE_SERVICE_ROLE_KEY | Supabase service role key |
OAUTH_CLIENT_ID | OAuth client ID |
ALLOWED_REDIRECT_URIS | Comma-separated allowed redirect URIs |
CORS_ORIGINS | Comma-separated allowed CORS origins |
OPENAI_API_KEY | _(Optional)_ Vector search embeddings |
npm install
npm run dev # tsx watch
npm run build # tsc → dist/
npm start # node dist/index.jsSet all variables under Settings → Variables (never commit .env). MCP_PUBLIC_URL = your Railway networking URL (no trailing /mcp). Health check endpoint: /health (configured in railway.toml).
Note: Node 20 on Railway — Supabase Realtime needs thewspackage (configured insrc/lib/supabase.ts). Optional: setRAILPACK_NODE_VERSION=22for native WebSocket support.
npm install
npm run dev # tsx watch
npm run lint # ESLint
npm run typecheck # tsc --noEmit
npm run build # compile → dist/
npm start # node dist/index.jsMarketplace reviewers: REVIEWER.md · MCP docs: memxus.com/docs/mcp
## [Unreleased] in CHANGELOG.mdpackage.json, server.json, and src/mcp/server.ts## [X.Y.Z] - YYYY-MM-DDgit tag -a vX.Y.Z -m "Memxus MCP vX.Y.Z"
git push origin vX.Y.ZPushing a v* tag triggers .github/workflows/release.yml — quality gate + GitHub Release with server.json attached.
Run from the repo root before making the repository public. Last audit: 2026-06-17 — PASSED
# 1. Verify .env was never committed
git log --all --full-history -- .env .env.local .env.production
# 2. Check for .env* files added in history
git log --all --oneline --diff-filter=A -- "*.env*"
# 3. Grep current tree for dangerous patterns (exclude .example)
git grep -rn -E "(service_role|anon_key|sk-[a-zA-Z0-9]{20,}|aimem_[a-zA-Z0-9]+|eyJ[a-zA-Z0-9_-]{20,})" \
-- ":(exclude)*.example" ":(exclude)CHANGELOG*"
# 4. Search full git history for leaked keys
git log --all -p --follow -S "service_role" -- . | head -100
git log --all -p --follow -S "SUPABASE_SERVICE_ROLE_KEY=" -- . | head -100| Check | Expected |
|---|---|
| Commands 1–2 | No .env commits (only .env.example in initial commit) |
| Command 3 | Only placeholders (aimem_YOUR_KEY), test fixtures, SQL comments |
| Command 4 | No real key values in diffs |
If commands 1 or 4 find real secrets, rotate keys immediately and run git filter-repo --path .env --invert-paths before publishing.
Licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).
You can use, modify, and distribute this code freely. If you use it to run a network service (SaaS), you must publish your source code under the same license.
© 2026 Gabriel Pitrella · memxus.com
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.